Cisco Cisco Firepower Management Center 4000

the table view of intrusion events

the packet view

Each of these pages is described in 

The drill-down views and table view of events share some common features that you can use to narrow 
a list of events and then concentrate your analysis on a group of related events. The following table 
describes these features.

learn more about the columns that 
appear

find more information in 

.

view a host’s profile

click the host profile icon (

) that appears next to the host IP address.

view geolocation details

click the flag icon that appears in the Source Country or Destination Country columns.

modify the time and date range for 
displayed events

find more information in 

Note that events generated outside the appliance's configured time window (whether 
global or event-specific) may appear in an event view if you constrain the event view 
by time. This may occur even if you configured a sliding time window for the 
appliance.

sort and constrain events on the 
current workflow page

find more information in:

the 

 table

the 

navigate within the current workflow 
page

find more information in 

To avoid displaying the same intrusion events on different workflow pages, the 
time range pauses when you click a link at the bottom of the page to display 
another page of events, and resumes when you click to take any other action 
on the subsequent page. For more information, see 

.

navigate between pages in the current 
workflow, keeping the current 
constraints

click the appropriate page link at the top left of the workflow page. For more 
information, see 

add events to the clipboard so you 
can transfer them to an incident at a 
later time

use one of the following methods:

To copy several intrusion events on a workflow page to the clipboard, select the 
check boxes next to events you want to copy, then click 

.

To copy all the intrusion events in the current constrained view to the clipboard, 
click 

.

The clipboard stores up to 25,000 events per user. For more information, see 

delete events from the event database use one of the following methods:

To delete selected intrusion events, select the check boxes next to events you want 
to delete, then click 

.

To delete all the intrusion events in the current constrained view, click 

, 

then confirm you want to delete all the events.